We are going to design and implement a UI for a big website. Owner of the site is really cautious about security issues. I wonder if there is a check list for security issues at the client-side ,while designing and coding in Javascript.
-
2What is the client protecting? What data is available via the website? What identification and authentication are you using, if any?– this.joshJul 18, 2011 at 19:26
Add a comment
|
2 Answers
There will never be a single perfect checklist, but here's a few things worth going through:
Wikipedia doesn't do half bad on this one
More for AJAX or other rich interfaces, but worth a read depending on your architecture - OWASP
This seems worth a test drive - haven't tried it myself - Javascript sandbox
Yes, none of these is a true "checklist" - IMO what you need to look for in Javascript vulnerabilities has a lot to do with how you are using it and what the rest of your architecture looks like - so I'm not sure a checklist will really cover the real concerns. It may be better to go through a risk analysis first, and then see how that translates into how you use the various web technologies as a collective.
answered Jul 18, 2011 at 14:36
-
1An additional step of value would be to perform validation of the developed environment. This could be performed in-house by an off-the-shelf application vulnerability scanner or by an independent third party. This should be done before the site goes live in production.– lewJul 19, 2011 at 5:00
-
@lour - great point! Thank you! Didn't even think of that (smacks self in head). Jul 20, 2011 at 14:06
-
-
@saeed, the validation should occur after development has finished. There is little value validating the product /before/ development has finished, as it is still subject to change.– lewJul 27, 2011 at 2:28
-
1"OWASP JavaScript Sandboxes is a Javascript sandbox which converts code using regular expressions." - hmmm.– shabuncAug 22, 2011 at 16:11
To properly secure a web application, you need to have a good idea of how browsers and servers work. Javascript is only the tip of the iceberg.
For an introductory (but thorough) review of web application security, I recommend Michal Zalewski's The Tangled Web. The book comes with checklists (called "security engineering cheat sheets") at the end of each chapter.
